nanoconsent

nanoconsent is a cookie consent banner that is 2,631 bytes gzipped in English — the whole thing, and under 2,750 bytes in every one of its eleven languages. Cookiebot’s stack is 113,994 bytes. The sizes are measured, not claimed, and the measurement script ships with the source.

What it does

• Blocks known trackers before they load — Google Analytics, Meta Pixel, Hotjar, Clarity, LinkedIn, TikTok and others are marked to wait for consent before the page is sent to the browser. Only scripts it recognises by name; it never guesses, so it cannot break a form, a menu or a cart.

• Holds YouTube, Vimeo, Google Maps, Facebook, Instagram, TikTok, Spotify and X embeds behind a small notice until marketing cookies are allowed. youtube-nocookie.com is not enough, and this handles it.

• Sends all six Google Consent Mode v2 signals, denied by default, updated when the visitor decides. Basic mode by default; advanced mode (Google tags load with signals denied, for conversion modelling) is one checkbox.

• Honours the Global Privacy Control signal — legally binding in twelve US states — records the refusal as proof, and shows “Opt-out signal honored” on the page, as California requires from 1 January 2026.

• Accept and reject buttons are identical in size and colour. Rejecting is one click, on the first layer.

• Stores every decision in your own database — time, choice, categories and text version. No IP address, no fingerprint. Export it as CSV; set a retention period or keep it forever.

• Makes no network requests of its own. Not to us, not to anyone — not even before consent.

• Accessible: a real dialog with a real heading, focus moves in and back out, Escape rejects, no keyboard trap, readable at 400 % zoom. Zero violations in axe-core against WCAG 2.2 AA on every state of the banner, and walked through with NVDA and Chrome by a person on 7 September 2026 — dialog announced on load, every control reachable and readable, focus returns after the choice.

What you see in the admin

• A health check that scans your front page and shows every tracker with its status: waits for consent, or loads before it. It also checks that Consent Mode defaults are set before the first Google tag — the silent misconfiguration that makes reports look fine while consent is ignored.

• Consent decisions per day, accepted-all rate, and what visitors allow per category.

• A live preview that runs the real banner while you change settings: position, colours, radius. The font is always your theme’s own.

• Finnish translation included.

What it is not

• Not a certified Google CMP. Certification is required only for publishers selling ad space through AdSense, Ad Manager or AdMob.

• Not legal advice. Compliance depends on how you configure it and what your site runs.

Source code

js (en, fi, sv, da, no, de, nl, fr, es, it, pl). json; each minified file is built from those two with esbuild and terser, nothing else.

External services

This plugin uses no external or third-party services. It makes no network requests of its own, on the front end or in the admin: no fonts, no CDN, no analytics, no licence check and no phoning home. Everything it needs ships inside the plugin folder.

The only request the plugin makes is from your own server to your own front page (home_url) when the settings page runs its health check, to verify that the banner is in place and loads before any tracking script; nothing is sent anywhere else.

The banner is embedded in the page itself, so it never fetches a script from anywhere. The consent log is written to your own database. The Google Consent Mode v2 signals are pushed to the dataLayer on the visitor’s own page; the plugin does not contact Google, and any request that does reach Google comes from the Google tag your site already loads — which this plugin blocks until the visitor consents.